Unauthorised Access

2019-05-1603:58:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

EPSS

0.004

Percentile

75.1%

JSON

Envoy is vulnerable to unauthorised access vulnerability. This occurs when parsing HTTP/1.x header values because envoy does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules and gain access to unauthorized resources.